bazarloader | a4adfb5e6dc3350bd280461eb97cd1b8abacdc8b87acf4ab9908baffd42ca921 | Triage™

Analysis

max time kernel
121s
max time network
160s
platform
windows10_x64
resource
win10-en-20211208
submitted
25/01/2022, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JavaObjectReflectiveW.dll
Size 218KB
Sample220125-wqarmscfb7
SHA256 a4adfb5e6dc3350bd280461eb97cd1b8abacdc8b87acf4ab9908baffd42ca921
MD5 ca39a01af86c78e28435ac83026a9506
SHA1 465cb1d634f030f4d2ca8e42c4bff3d644da7bb4
SHA512 b389a58095a91f0b54e1b2e12c9af06b68bf70b955f9139502b8c867c73b6afd0b0a479b175e280cdc6e7468977a6757a3c6f8c9dfd832c9f92b62dbf2c4fb01
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 1 IoCs

resource	yara_rule
behavioral2/memory/2180-115-0x0000000180000000-0x000000018003C000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 4 IoCs

flow	pid	Process
29	2180	rundll32.exe
36	2180	rundll32.exe
44	2180	rundll32.exe
45	2180	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JavaObjectReflectiveW.dll,#1
1⤵
- Blocklisted process makes network request
PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-115-0x0000000180000000-0x000000018003C000-memory.dmp

Download